CVE-2026-81724
MediumCVSS 5.3Summary
NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.
Risk Assessment
The risk includes the possibility of crashing applications by an unauthenticated attacker, leading to service unavailability. This could be exploited for DoS attacks on systems using NLTK.
Recommendation
It is recommended to update NLTK to version 3.10.3 or later, which includes the fix. Also consider restricting access to functions that process feature structures.
Original NVD description (English source)
NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.